BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1413033014

Cr-Commit-Position: refs/heads/master@{#31777}

This removes special casing for the 'f.arguments' property accessor. Any
local 'arguments' variable should not be allowed to influence the value
returned by the indirect 'f.arguments' property. That property creates a
new object with a separate identity everytime it is read. This is by now
consistent with other browsers.

R=rossberg@chromium.org
TEST=mjsunit/arguments-indirect

Review URL: https://codereview.chromium.org/1408983006

Cr-Commit-Position: refs/heads/master@{#31776}

Review URL: https://codereview.chromium.org/1414403003

Cr-Commit-Position: refs/heads/master@{#31775}

Adds support for calling JS runtime functions. Also changes the bytecode
array builder to allow calling functions with an invalid argument
register if the call takes no arguments.

Adds the bytecode CallJSRuntime.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1410003003

Cr-Commit-Position: refs/heads/master@{#31774}

R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31773}

Use the type specified for StoreField and StoreElement to check whether
we are storing a TaggedSigned value, and skip the write barrier for the
write completely in that case.  Also make sure to set that field type
appropriately for JSGlobalObjectSpecialization.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410743009

Cr-Commit-Position: refs/heads/master@{#31772}

We don't need to distinguish between signed and unsigned integral
representations in the big boy type system. It actually even hurts
in some cases. The representation is only about the way the values
are mapped to bits in memory/registers, but the interpretation of
the bits is specified by the semantic dimension.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1416953006

Cr-Commit-Position: refs/heads/master@{#31771}

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1422623013

Cr-Commit-Position: refs/heads/master@{#31770}

We used to mark a block as needing frame based solely on
the spill list. With splintering, that is not entirely
accurate. With this change, for ranges that spill only in
deferred blocks, we mark the start of each block in which a
child range spills as needing a frame.

BUG=v8:4533
LOG=n

Review URL: https://codereview.chromium.org/1408183007

Cr-Commit-Position: refs/heads/master@{#31769}

Rolling v8/build/gyp to 2c1e6cced23554ce84806e570acea637f6473afc

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1413923012

Cr-Commit-Position: refs/heads/master@{#31768}

The "harmony"-prefixed files have been included in the snapshot for
several releases now, and were only separate originally to enable
loading them via a runtime flag. This patch simply merges them into
the main implementation files for Arrays and TypedArrays, respectively.

Review URL: https://codereview.chromium.org/1416243007

Cr-Commit-Position: refs/heads/master@{#31767}

BUG=

Review URL: https://codereview.chromium.org/1430943004

Cr-Commit-Position: refs/heads/master@{#31766}

Revert of [heap] Turn on parallel compaction (patchset #1 id:1 of https://codereview.chromium.org/1364693002/ )

Reason for revert:
Fails on gc stress
  https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/157/

Original issue's description:
> [heap] Turn on parallel compaction
>
> R=hpayer@chromium.org
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/04db5bfa915766b228218ddc748af308b57ae8ea
> Cr-Commit-Position: refs/heads/master@{#31763}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1424313008

Cr-Commit-Position: refs/heads/master@{#31765}

Only cast to integer with xor (closer to the spec which allows only ~~).
Check type matching on the bitwise operations.
Prevent mixing of types with the arthimetic operations.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1405383007

Cr-Commit-Position: refs/heads/master@{#31764}

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1364693002

Cr-Commit-Position: refs/heads/master@{#31763}

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1410633005

Cr-Commit-Position: refs/heads/master@{#31762}

BUG=

Review URL: https://codereview.chromium.org/1396133002

Cr-Commit-Position: refs/heads/master@{#31761}

BUG=v8:3886
LOG=Y

Review URL: https://codereview.chromium.org/1422853004

Cr-Commit-Position: refs/heads/master@{#31760}

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1424283002

Cr-Commit-Position: refs/heads/master@{#31759}

Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )

Reason for revert:
[Sheriff] Changes layout tests. Please rebase upstream first. E.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2686

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1427733005

Cr-Commit-Position: refs/heads/master@{#31758}

Corrects LdaGlobal to deal with TypeofMode::INSIDE_TYPEOF so that it
doesn't throw a reference error on undefined globals.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1422443006

Cr-Commit-Position: refs/heads/master@{#31757}

Original issue's description:
> [es6] Fix Function and GeneratorFunction built-ins subclassing.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/99e7f872d3d0a5fb799dcbafb05537cda491314a
> Cr-Commit-Position: refs/heads/master@{#31708}

The problem was in another CL, this is a clean reland with improved tests.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1415683007

Cr-Commit-Position: refs/heads/master@{#31756}

This matches the approach used for @@isConcatSpreadable, and seems to
match what Mozilla is planning to do in Firefox.

Given that there's already little compatibility around cross-origin toString
results, there seems to be little hazard in making this change even before
spec language hits the HTML spec.

BUG=v8:3502, v8:4289, chromium:532469
LOG=n

Review URL: https://codereview.chromium.org/1432543002

Cr-Commit-Position: refs/heads/master@{#31755}

Review URL: https://codereview.chromium.org/1432493003

Cr-Commit-Position: refs/heads/master@{#31754}

R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31753}

Review URL: https://codereview.chromium.org/1424333002

Cr-Commit-Position: refs/heads/master@{#31752}

If the property is a data property on the holder (or does not exist) and is a readonly data property in the receiver, then we must fail.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1424233005

Cr-Commit-Position: refs/heads/master@{#31751}

BUG=v8:4534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1413723011

Cr-Commit-Position: refs/heads/master@{#31750}

R=bmeurer@chromium.org
TEST=mozilla/js1_5/Regress/regress-343713

Review URL: https://codereview.chromium.org/1424313007

Cr-Commit-Position: refs/heads/master@{#31749}

The JSNativeContextSpecialization class is getting rather huge with all
the stuff related to property and element access going in. Splitting off
the global object related stuff into JSGlobalObjectSpecialization seems
like a natural separation, especially since the global object
specialization is sort of separate issue anyway.  This is neutral
functionality- and performance-wise.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1417043006

Cr-Commit-Position: refs/heads/master@{#31748}

R=neis@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1422803003

Cr-Commit-Position: refs/heads/master@{#31747}

R=yangguo@chromium.org
TEST=cctest/test-debug/Backtrace

Review URL: https://codereview.chromium.org/1415463017

Cr-Commit-Position: refs/heads/master@{#31746}

R=verwaest@chromium.org
BUG=chromium:548194
LOG=y

Review URL: https://codereview.chromium.org/1426293003

Cr-Commit-Position: refs/heads/master@{#31745}

Review URL: https://codereview.chromium.org/1410023013

Cr-Commit-Position: refs/heads/master@{#31744}

1) The Map::CopyInitialMap() did not set descriptor's array if
the source initial map had one.
2) Subclasses are temporarily disallowed to have more in-object
properties than the parent class (for GC reasons).

BUG=v8:3101, v8:3330, v8:4531
LOG=N

Review URL: https://codereview.chromium.org/1431593003

Cr-Commit-Position: refs/heads/master@{#31743}

This changes the inlining candidates to be stored in a sorted set of
unique entries instead of a vector. We can avoid the final sorting
operation by amortizing the cost across insertions and also duplicate
entries are not created in the first place. Duplicate entries cause
crashes when candidates are processed.

R=bmeurer@chromium.org
BUG=chromium:549113
LOG=n

Review URL: https://codereview.chromium.org/1430553003

Cr-Commit-Position: refs/heads/master@{#31742}

Existing code was assuming that 'lexical' blocks were the same as basic
blocks, therefore code which emitted jumps within a lexical block (e.g.,
logical or) would in some occassions incorrectly omit a necessary
ToBoolean.

This change removes Enter/LeaveBlock from BytecodeArrayBuilder and
instead tracks basic blocks via label bindings and jump operations. The
change also ensures we don't emit dead code at the end of a basic block,
and adds tests of the edge cases.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1406983010

Cr-Commit-Position: refs/heads/master@{#31741}

The flake detection is done on the infra-side according to
the contents of the json test results. We don't want the
runner to fail after flakes.

This was controlled on the infra side by accepting any exit
codes so far. After the swarming switch, this is more
difficult, because the runner is wrapped by the swarming
collect script. There, failing exit codes can mean many
things, including network failures. Therefore, we now
force exit code 0 with test failures if those failures
are reported in the formal test results json.

The infrastructure will take care of reporting the flakes
and failures accordingly.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1416373005

Cr-Commit-Position: refs/heads/master@{#31740}

TurboFan is actually able to generate property access to all prototypes
of all primitives, except the special Oddball primitives that have no
wrapper counterparts (namely null and undefined from the ES6 point of
view).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1409163007

Cr-Commit-Position: refs/heads/master@{#31739}

This CL fixes an invalid cast in Slow_ArrayConcat (a Proxy on a DICTIONARY_ELEMENTS array's prototype chain).
It also adds some comments and minor drive-by refactorings to other PrototypeIterator use sites.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1402393003

Cr-Commit-Position: refs/heads/master@{#31738}